You really need to database your passwd auth

sasl supports pgsql / mysql

you can then alter the queries by selecting flags pending the access you want to allow

dovecot-pgsql.conf

password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u'

user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u'

#iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u'

iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False

postfix

smtpd.conf -> /usr/local/lib/sasl2/smtpd.conf

#Postygres pwcheck_method: auxprop mech_list: PLAIN LOGIN auxprop_plugin: sql sql_engine: pgsql sql_hostnames: pg.scom.ca:5433 sql_database: scom_billing sql_user: xxxx sql_passwd: xxxx sql_select: SELECT password FROM email_users WHERE username = '%u@%r' and password <> 'alias' and currentcount_bad < 30 and status = True

i use status to allow disabling the users ability to login but you can easily expand the select statement to include another flag for imap user(s)

Happy Wednesday !!! Thanks - paul

Paul Kudla

Scom.ca Internet Services http://www.scom.ca 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3

Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul@scom.ca

On 6/1/2022 7:40 AM, dovecot-bounces@dovecot.org wrote:

Hi,

we have a very simple user-/passdb (like passwd) to authenticate virtual IMAP users. We also use this for Postfix authentication. Nothing special.

But, we need to exclude some of the users from IMAP login. This means, some users should be allowed to send mail via Postfix (submission) and therefore authenticate via SASL against dovecot successfully, but they should not be allowed to login to their IMAP mail box.

How could this be done?

Thanks! -lutzn

we have a very simple user-/passdb (like passwd) to authenticate virtual IMAP users. We also use this for Postfix authentication. Nothing special.

But, we need to exclude some of the users from IMAP login.

How could this be done?

There's a facility to add arbitrary code to the imap login process, e.g., in "10-master.conf":

service imap-postlogin { executable = script-login /local/bin/imap-wrapper user = $default_internal_user unix_listener imap-postlogin { } }

In our case, "/local/bin/imap-wrapper" is a Perl script that checks the user's login shell, and if it is one of our "blocked" shells, returns:

print "* NO [ALERT] Your account has expired, and access to it has been suspended. ".$msg_helpdesk_refer; exit 1;

otherwise it execs the command given in its arguments.

More info is at: https://doc.dovecot.org/admin_manual/post_login_scripting/

Anne.

Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne@encs.concordia.ca +1 514 848-2424 x2285